Pierluigi Paganini April 25, 2021

Threat actors are exploiting two flaws in the popular file-sharing server FileZen to steal sensitive data from businesses and government organizations.

Threat actors are exploiting two vulnerabilities in the popular file-sharing server FileZen, tracked as CVE-2020-5639 and CVE-2021-20655, to steal sensitive data from businesses and government organizations.

FileZen servers allow users to share data according to their needs, overcoming problems with file size limits, content filters, and potential loss.

The CVE-2020-5639 vulnerability is a Directory traversal issue that could be exploited by remote attackers to upload an arbitrary file in a specific directory via unspecified vectors, potentially leading to arbitrary OS command execution.

The CVE-2021-20655 vulnerability could be exploited by a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.

Soliton addressed both flaws in FileZen solutions with the release of firmware versions V4.2.8 and V5.0.3.

The attacks are part of a large-scale campaign that also resulted in unauthorized access to a Soliton file shared storage used by the Japanese Prime Minister’s Cabinet Office staff.

Experts pointed out that the attacks begun before the vendor has fixed the issues, this means that we cannot exclude that threat actors have compromised organizations using the popular file-sharing servers

The vendor recommended changing system administrator account, reset access control, and installing the latest available version.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, FileZen)

[adrotate banner=”5″]

[adrotate banner=”13″]